ssrf-server-side-request-forgery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The playbook explicitly instructs retrieving cloud metadata and service-account tokens (e.g., IMDSv1/IMDSv2, Kubernetes token file) and shows using a retrieved TOKEN in subsequent HTTP headers/requests, which requires the agent to read and include secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are highly suspicious because they enumerate cloud metadata endpoints, local admin/service interfaces, obfuscated/credential-bearing authorities and redirect/shortener endpoints commonly used in SSRF/exfiltration and remote code‑execution chains.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive SSRF exploitation playbook providing step-by-step instructions to exfiltrate cloud credentials, perform remote code execution (reverse shells), write backdoors (cron jobs, authorized_keys, webshells), and use protocol abuse (gopher/dict) and DNS rebinding to bypass protections — clearly malicious and intended for abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs actions that modify or take over a host (e.g., creating privileged Docker containers that mount /, writing cron reverse shells via Redis/gopher/dict and dropping webshells), which directly push an agent to compromise the machine's state.